XSS issues in Nagios CGI (CVE-2007-5803)

[Thierry Carrez]

Binary package hint: nagios2

Multiple cross-site scripting (XSS) vulnerabilities in CGI programs in Nagios before 2.12 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2007-5624 and CVE-2008-1360.

Note that this also affects nagios3 (before 3.0.2).
I'm working on a patch.

[Thierry Carrez (ttx)]

Here is a backport (XSS fixes only) from Nagios 2.12.
For Nagios 3.x (Intrepid) we should probably upgrade to 3.0.2.

[Thierry Carrez (ttx)]

nagios3 updated in Debian unstable to 3.0.2-1, waiting for autosync.

[Thierry Carrez (ttx)]

Auto-synced to 3.0.2-1

[Launchpad Janitor (janitor)]

This bug was fixed in the package nagios2 - 2.11-1ubuntu1.2

---------------
nagios2 (2.11-1ubuntu1.2) hardy-security; urgency=low

  * SECURITY UPDATE: fix XSS issues in CGI scripts thanks to Thierry Carrez
  * debian/rules: fix nagios2-common upgrade failure. Thanks to Thierry Carrez
  * References
    CVE-2007-5803
    LP: #238516
    LP: #220208

 -- Jamie Strandboge <email address hidden> Thu, 19 Jun 2008 12:30:11 -0400

[Hew (hew)]

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

[Sergio Zanchetta (primes2h)]

The 18 month support period for Gutsy Gibbon 7.10 has reached its end of life -
http://www.ubuntu.com/news/ubuntu-7.10-eol . As a result, we are closing the
Gutsy task.